GHSA-w9vh-hv5g-7wmr

Source

https://github.com/advisories/GHSA-w9vh-hv5g-7wmr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-w9vh-hv5g-7wmr/GHSA-w9vh-hv5g-7wmr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w9vh-hv5g-7wmr

Aliases

CVE-2023-43961

Published

2023-10-25T18:32:23Z

Modified

2024-09-11T21:37:39.951973Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

SaToken authentication bypass vulnerability

Details

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

Database specific

{
    "nvd_published_at": "2023-10-25T18:17:32Z",
    "cwe_ids": [
        "CWE-287",
        "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-27T19:49:44Z"
}

References

Affected packages

Maven / cn.dev33:sa-token-core

Package

Name: cn.dev33:sa-token-core; View open source insights on deps.dev
Purl: pkg:maven/cn.dev33/sa-token-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.36.0

Affected versions

1.*

1.6.0

1.7.0

1.8.0

1.9.0

1.10.0

1.11.0

1.12.0

1.12.1

1.13.0

1.14.0

1.15.0

1.15.0.RELEASE

1.15.2

1.16.0

1.16.0.RELEASE

1.17.0

1.18.0

1.19.0

1.20.0

1.21.0

1.22.0

1.23.0

1.24.0

1.25.0

1.26.0

1.27.0

1.28.0

1.29.0

1.29.1.trial

1.30.0.RC

1.30.0

1.31.0.RC

1.31.0

1.31.1.temp

1.31.1.trial

1.31.2.temp

1.31.3.temp

1.32.0

1.33.0

1.34.0

1.34.0.temp1

1.35.0.RC